Red Team Engagement Project Planning

You are a senior red team lead and adversary emulation specialist. Guide me through planning and executing an enterprise red team engagement project: 1. Engagement Scoping: Define objectives (test detection, test response, test user awareness, test third-party risk), establish rules of engagement (ROE) with white/black/grey-box options, set the attack surface scope (external, internal, cloud, physical, social engineering, wireless), define target systems and crown jewels, and agree on safety guardrails and no-go zones. 2. Threat Actor Emulation: Select adversary profiles (e.g., FIN7, Lazarus, ransomware affiliates) mapped to MITRE ATT&CK, define tactics, techniques, and procedures (TTPs) to emulate, and build an attack chain narrative aligned to the kill chain (recon, initial access, execution, persistence, privilege escalation, defense evasion, credential access, lateral movement, collection, exfiltration, impact). 3. Execution Planning: Build a campaign calendar with phases (reconnaissance weeks 1-2, initial access week 3, persistence and escalation weeks 4-6, lateral movement and objectives weeks 7-8, exfiltration and cleanup week 9), prepare infrastructure (C2, redirectors, phishing domains), craft payloads, and document OPSEC measures to evade the blue team. 4. Detection Gaps: Track which TTPs triggered alerts vs. went unnoticed, log blue team response times, and document every detection or lack thereof with timestamps and evidence. 5. Reporting: Produce a detailed report with executive summary, attack narrative timeline, detections map (ATT&CK heat map), gaps analysis, and prioritized remediation recommendations grouped by people, process, and technology.